Re: [PATCH v2] add networks with faked KP location

["Peter Müller" <peter.mueller@link38.eu>]

[-- Attachment #1: Type: text/plain, Size: 3332 bytes --]

- ping -

> These networks claim to be located in North Korea, but are mostly used
> for VPN or other anonymisation purposes. Therefore they are added to
> A1 or "others" override files.
> 
> See https://blog.trendmicro.com/trendlabs-security-intelligence/a-closer-look-at-north-koreas-internet/
> for details. 57.73.224.0/19 was reassigned since then and contains
> valid data now, causing it to be omitted.
> 
> The second version of this patch superseds the first
> one which was broken due to bugs in the MUAs GPG implementation.
> 
> Fixes #11757.
> 
> Signed-off-by: Peter Müller <peter.mueller(a)link38.eu>
> ---
>  country-overrides/override-a1.txt    | 25 +++++++++++++++++++++++++
>  country-overrides/override-other.txt |  5 +++++
>  2 files changed, 30 insertions(+)
> 
> diff --git a/country-overrides/override-a1.txt b/country-overrides/override-a1.txt
> index bae4ee9..0e94eee 100644
> --- a/country-overrides/override-a1.txt
> +++ b/country-overrides/override-a1.txt
> @@ -116,6 +116,16 @@ descr:		Privax LTD
>  remarks:	VPN provider
>  newcountry:	A1
>  
> +net:		5.62.56.160/30
> +descr:		Privax LTD/AVAST s.r.o.
> +remarks:	VPN provider, fake location (KP)
> +newcountry:	A1
> +
> +net:		5.62.61.64/30
> +descr:		Privax LTD/AVAST s.r.o.
> +remarks:	VPN provider, fake location (KP)
> +newcountry:	A1
> +
>  net:		5.249.160.0/24
>  descr:		VPNTunnel
>  remarks:	VPN provider
> @@ -226,6 +236,11 @@ descr:		GZ Systems Limited/PureVPN
>  remarks:	VPN provider
>  newcountry:	A1
>  
> +net:		45.42.151.0/24
> +descr:		Manpo ISP/OppoBox LLC/Roya Hosting
> +remarks:	VPN provider [high confidence, but not proofed], fake location (KP)
> +newcountry:	A1
> +
>  net:		46.243.136.0/24
>  descr:		GZ Systems Limited/PureVPN
>  remarks:	VPN provider
> @@ -626,6 +641,11 @@ descr:		Secure Internet LLC
>  remarks:	VPN provider [high confidence, same contact person as for GZ Systems Ltd., but not proofed]
>  newcountry:	A1
>  
> +net:		172.97.82.128/25
> +descr:		Fiber Galaxy/Manpo ISP
> +remarks:	VPN provider [high confidence, but not proofed], fake location (KP)
> +newcountry:	A1
> +
>  net:		173.239.207.0/24
>  descr:		ExpressVPN
>  remarks:	VPN provider
> @@ -676,6 +696,11 @@ descr:		Sys11 VPN Services UG (haftungsbeschraenkt)
>  remarks:	VPN provider
>  newcountry:	A1
>  
> +net:		185.56.163.144/28
> +descr:		Easy Networks Solutions OU/VPNFacile
> +remarks:	VPN provider [high confidence, but not proofed], fake location (KP)
> +newcountry:	A1
> +
>  net:		185.161.200.0/23
>  descr:		ProtonVPN AG
>  remarks:	VPN provider
> diff --git a/country-overrides/override-other.txt b/country-overrides/override-other.txt
> index 1a83829..edb88a3 100644
> --- a/country-overrides/override-other.txt
> +++ b/country-overrides/override-other.txt
> @@ -66,3 +66,8 @@ descr:		IPv6 localhost address
>  remarks:	must not be added to the database
>  newcountry:
>  
> +# networks with faked location
> +net:		88.151.117.0/24
> +descr:		Golden Internet LLC
> +remarks:	fake location (KP), WHOIS contact points to RU
> +newcountry:	RU
> 

-- 
Microsoft DNS service terminates abnormally when it recieves a response
to a DNS query that was never made.  Fix Information: Run your DNS
service on a different platform.
		-- bugtraq